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This is in response to the appeal brief filed February 28, 2005. 
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(1) Real Party in Interest 

A statement identifying the real party in interest is contained in the brief. 

(2) Related Appeals and Interferences 

The brief contains a statement that no related and/or interferences are pending. 

(3) Status of Claims 

The statement of the status of the claims contained in the brief is correct 

(4) Status of Amendments After Final. 

The Appellant's statement of the status of amendments after final rejection contained in 
the brief is correct 

(5) Summary of the Invention. 

The summary of the invention contained in the brief is correct. 

(6) Issues. 

The Appellant's statement of the issues in the brief is correct. 

(7) Grouping of Claims. 

The Appellant's brief includes a statement that the claims stand or fall together. 

(8) Claims Appealed. 

The copy of the appealed claims contained in the Appendix to the brief is correct. 

(9) Prior Art Record. 

6, 1 5 8,0 1 0 Moriconi 1 2/2000 
WO 98/40987 Abraham 03/1998 

(10) Ground of Rejection. 

Claim Rejections - 35 USC §101 
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35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or 
any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and 
requirements of this title. 

Claim 1 is rejected under 35 U.S.C. 101 because the claimed invention is directed to non- 
statutory subject matter. In claim 1 the applicant claims a method for creating policy groups, 
moving a data element between groups and generating a privacy policy based upon the policy 
group. This process might be performed without the aid of any technology and therefore the 
claimed method is not within the technological arts. 

All that is necessary to make a sequence of operational steps in a statutory process within 
35 U.S.C. 101 is that it be in the technological arts so as to be in concordance with the 
Constitutional purpose to promote the progress of "useful arts" In re Musgrave, 431 F. 2d 882 
167 USPQ 280 (CCPA 1970) 

A claim is limited to a practical application when the method, as claimed, produces a 
concrete, tangible and useful result: i.e. the method recites a step or act of producing something 
that is concrete, tangible and useful. See AT&T v. Excel Communications Inc., 172 F3d at 1358, 
50USPQ2dat 1452. 

Claims 1-5 and 8-1 1 are dependant on rejected claim 1, and are rejected for at least the 
same reasons. 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

Claims 1- 24 are rejected under 35 U.S.C. 103(a) as being unpatentable over Moriconi et 
al (US Patent 6,158,010) in view of Abraham et al. (WO 98/40987). 

As per claim 1 , 

Moriconi et al ('010) discloses a method for creating a privacy policy, comprising: 

moving a data element to the policy group;(Figure 9) 

generating a privacy policy based on the policy group.(Figure 4) 

Moriconi et al ('010) does not explicitly disclose creating a policy group, Abraham et al. 
('987) discloses creating a policy group.(Abstract) It would have been obvious to one having 
ordinary skill in the art at the time the invention was made to combine the Moriconi et al ('OlO)'s 
method with the Abraham et al. ('987)'s method in order to secure management of a computer 
network 
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As per claim 2, 

Moriconi et al ('010) discloses the method of claim 1, 

wherein the data element is a predefined data element.(Column 6, lines 20-26) 
As per claim 3, 

Moriconi et al ('010) discloses the method of claim 1, 

wherein the data element comprises at least one sub-element.(Column 6, lines 46-51) 
As per claim 4 5 

Moriconi et al ( c 010) discloses the method of claim 1, further comprising: 
updating a policy-wide property; and generating the privacy policy based on the policy- 
wide property.(Column 5, lines 48-55) 

As per claim 5, 

Moriconi et al ('010) discloses the method of claim 1, 

wherein the step of generating a privacy policy comprises generating a human readable 
version of the policy.(Column 9, lines 45-50 - Examiner notes that although Moriconi et al does 
not specifically disclose "generating a human readable version of the policy" it would be obvious 
that if the policy is manipulated via a GUI it would be readable to the user.) 

As per claim 6, 

Moriconi et al ('010) discloses the method of claim 5 5 

Official Notice is taken that "hypertext markup language version of the policy" is 
common and well known in prior art in reference to policy management. It would have been 
obvious to one having ordinary skill in the art at the time the invention was made to render the 
policy in HTML format in order to provide a format that is universally viewable across a wide 
variety of computer platforms and operating systems. 

As per claim 7, 

Moriconi et al ('010) discloses the method of claim 1, 

Official Notice is taken that "generating an extensible markup language version of the 
policy" is common and well known in prior art in reference to policy management. It would 
have been obvious to one having ordinary skill in the art at the time the invention was made to 
render the policy in XML format in order to provide a format that is universally viewable across 
a wide variety of computer platforms and operating systems. 

As per claim 8, 

Moriconi et al ('010) discloses the method of claim 1 , 

wherein the step of generating a privacy policy comprises generating a compact 
policy.(Figure 4 - note element 436 optimizer) 

As per claim 9, 

Moriconi et al ('010) discloses the method of claim 1, 
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wherein the step of generating a privacy policy comprises generating a policy statement 
corresponding to the policy group. (Figure 4) 

As per claim 10, 

Moriconi et al ( 6 010) discloses the method of claim 9, 

wherein the step of generating a privacy policy further comprises generating a table of 
policy elements, wherein a policy element in the table of policy elements corresponds to the 
policy statement.(Column 4, lines 34-37 — the rules [i.e. elements] are stored in a database [i.e. 
table]) 

As per claim 11, 

Moriconi et al ('010) discloses the method of claim l,further comprising: 
identifying an error in the privacy policy ;(Column 1 1, lines 44-46 - Although Moricini 
does not specifically disclose generating an error statement describing the error he does disclose 
generating a log file, it is well known within modern computing systems to automate the 
generation of error reports from log files) 

As per claim 12, 

Moriconi et al ('010) discloses an apparatus for creating a privacy policy, comprising: 
movement means for moving a data element to the policy group;(Figure 9) 
generation means for generating a privacy policy based on the policy group.(Figure 4) 
Moriconi et al ('01 0) does not explicitly disclose creation means for creating a policy 
group, Abraham et al. ('987) discloses creation means for creating a policy group.(Abstract) It 
would have been obvious to one having ordinary skill in the art at the time the invention was 
made to combine the Moriconi et al ('010)'s apparatus with the Abraham et al. ('987)'s 
apparatus in order to secure management of a computer network 

As per claim 13, 

Moriconi et al ('010) discloses the apparatus of claim 12, 

wherein the data element is a predefined data element. (Column 6, lines 20-26) 

As per claim 14, 

Moriconi et al ('010) discloses the the apparatus of claim 12, 

wherein the data element comprises at least one sub-element. (Column 6, lines 46-51) 
As per claim 15, - 

Moriconi et al ('010) discloses the apparatus of claim 12, further comprising: 
means for updating a policy- wide property; and means for generating the privacy policy based on 
the policy-wide property. (Column 5, lines 48-55) 

As per claim 16, 

Moriconi et al ( 6 010) discloses the apparatus of claim 12, 

wherein the generation means comprises means for generating a human 
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readable version of the policy.(Column 9, lines 45-50 - Examiner notes that although Moriconi 
et al does not specifically disclose "generating a human readable version of the policy" it would 
be obvious that if the policy is manipulated via a GUI it would be readable to the user.) 

As per claim 17 

Moriconi et al ('010) discloses the apparatus of claim 16, 

Official Notice is taken that "hypertext markup language version of the policy" is 
common and well known in prior art in reference to policy management. It would have been 
obvious to one having ordinary skill in the art at the time the invention was made to render the 
policy in HTML format in order to provide a format that is universally viewable across a wide 
variety of computer platforms and operating systems. 

As per claim 18 

Moriconi et al ('010) discloses the apparatus of claim 19, 

Official Notice is taken that "generating an extensible markup language version of the 
policy" is common and well known in prior art in reference to policy management. It would 
have been obvious to one having ordinary skill in the art at the time the invention was made to 
render the policy in XML format in order to provide a format that is universally viewable across 
a wide variety of computer platforms and operating systems. 

As per claim 19, 

Moriconi et al ('010) discloses the apparatus of claim 12, 

wherein the generation means comprises means for generating a compact policy.(Figure 4 
- note element 436 optimizer) 

As per claim 20, 

Moriconi et al ('010) discloses the apparatus of claim 12, 
wherein the generation means comprises means for generating a policy statement corresponding 
to the policy group.(Figure 4) 

As per claim 21 

Moriconi et al ('010) discloses the apparatus of claim 20, 

wherein the generation means further comprises means for generating a table of policy 
elements, wherein a policy element in the table of policy elements corresponds to the policy 
statement.(Column 4, lines 34-37 — the rules [i.e. elements] are stored in a database [i.e. table]) 

As per claim 22, 

Moriconi et al ('010) discloses the apparatus of claim 12, further comprising: means for 
identifying an error in the privacy policy ;(Column 11, lines 44-46 - Although Moricini does not 
specifically disclose generating an error statement describing the error he does disclose 
generating a log file, it is well known within modern computing systems to automate the 
generation of error reports from log files) 
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As per claim 23, 

Moriconi et al ('010) discloses an interface for creating a privacy policy, comprising: 
a first portion for displaying predefined data elements;(Column 9, lines 45-50) 
a second portion for displaying groups of data elements, wherein a group of data 
elements shares at least one common property;(Figure 4) 

Moriconi et al ('010) does not explicitly disclose a third portion for displaying a privacy 
policy generated from the groups of data elements, Abraham et al. ( c 987) discloses a third 
portion for displaying a privacy policy generated from the groups of data elements.(Abstract) It 
would have been obvious to one having ordinary skill in the art at the time the invention was 
made to combine the Moriconi et al ('OlO)'s method with the Abraham et al. ('987)'s method in 
order to secure management of a computer network 

As per claim 24, 

Moriconi et al ('010) discloses a computer program product, in a computer 
readable medium, for creating a privacy policy, comprising: 

instructions for moving a data element to the policy group(Figure 9) 
instructions for generating a privacy policy based on the policy group. (Figure 4) 
Moriconi et al ('010) does not explicitly disclose instructions for creating a policy group, 
Abraham et al. ('987) discloses instructions for creating a policy group. (Abstract) It would have 
been obvious to one having ordinary skill in the art at the time the invention was made to 
combine the Moriconi et al ('010)'s method with the Abraham et al. ('987)'s method in order to 
secure management of a computer network 



(11) Response to Argument. 

First Issue 
A.l Claims 1-11 

The Examiner states that although the preamble of Claim 1 recites "A data processing 
apparatus" there is no functional interrelationship between the language of the preamble and the 
body of the claim. . In claim 1 the applicant claims a method for creating policy groups, moving 
a data element between groups and generating a privacy policy based upon the policy group. 
This process might be performed without the aid of any technology and therefore the claimed 
method is not within the technological arts. 

With respect to claims 2-1 1 the examiner finds that claims 6 and 7 embody a non-trivial use of 
technology, therefore the rejection under 35 U.S.C 101 is maintained upon claims 1-5, 8-1 1 
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A.2 Claims 12-22 

The Examiner withdraws the rejection under 35 U.S.C 101 for claims 12-22 
Second Issue 

B.l Claims 1,12 and 24 

In response to applicant's argument that the references to Moriconi et al (US Patent 
6,158,010) in view of Abraham et al. (WO 98/40987) are nonanalogous art, it has been held that 
a prior art reference must either be in the field of applicant's endeavor or, if not, then be 
reasonably pertinent to the particular problem with which the applicant was concerned, in order 
to be relied upon as a basis for rejection of the claimed invention. See In re Oetiker, 977 
F.2d 1443, 24 USPQ2d 1443 (Fed. Cir. 1992). In this case, the applicant makes a series of 
generalized assertions concerning the relationship between privacy and security. The Examiner 
holds that broad generalizations as to the nature of the clients invention are inapplicable and that 
each claimed feature has been examined on it's own merits. The Moriconi reference describes a 
system by which a set of rules are applied to a set of users in a computer system, the examiner 
contends that in this specific instance the cited art demonstrates a policy for enforcing security 
and creating privacy at the same time. 

B.2. Claim 4 and 15 

The examiner maintains that the Moriconi reference meets the claimed limitation of 
"updating a policy wide property, and generating a privacy policy based on a policywide 
property" ; as Moriconi states "a system for managing and enforcing security requirements in a 
distributed computer network . . . and distributing a policy to a client" . The examiner contends 
that the management of a policy would include the updating of a policy and the distribution of 
the policy shows the adherence of multiple client tot a policywide property. 

B.3.Claim5andl6 

The examiner maintains that if a Graphical User Interface is used then the content 
rendered by the GUI is obviously readable by humans. 

B.4. Claim 6,7,17 and 18 

The examiner contends that the Applicant has made no formal challenge to the Official 
Notice taken in the prior rejections, 
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To adequately traverse such a finding, an applicant must specifically point out the 
supposed errors in the examiner's action, which would include stating why the noticed 

fact k not considered to be common knowledge or well-known in the ait. See 37 CFR 
1.111(b). See also Chevenard, 139 R 2d at 713, 60 USPQ at 241 ( f {f]n Hie Jfe|||f 
any demand by appellant for the examiner to pro duce authority for his statement, we vffi 
not consider this contention."). A general allegation that the claims define a patentable 
invention without any reference to the examiner's assertion of official notice w r ould be 
inadequate. If applicant adequately travei'ses the examiner's assertion of official notice, 
the examiner must provide documentary evidence in the next Office action if the rej ection 
is to be maintained. See 37 CFR 1. 104(c)(2) See also Zurko, 258 R3d at 1386, 59 
USPQ2 d at 1697 ( f, [T]he Board [or examiner] must point to some concrete evidence in 
the record in support of these findings" to satisfy the siibstantial eviddipf test). If th e 
examiner is reding on personal toiowledge to support the finding of wiiat is kiowii in the I 
art, the examiner must provide an specific fiictual 

statements and explanation to suppoit tlie finding. See 37 CFR 1. 104(d)(2). 
If applicant does not traverse the examiners assertion of official notice or applicant's 
traverse is not adequate, the examiner should clearly indicate in die next Office action that 
the common knowledge or well-known in tlie ait statement is taken to be admitted prior 
ait because applicant either Med to traverse the examiner's asseilion of official notice or; 
tfiat tlie traverse was inadequate. If the traverse was inadequate, the examiner should 
iiclude aii expkiation as to >^ 

B.5. Claim 10 and 21 

The examiner contends that a table and a database are analogous features, Moriconi 
discloses a database (i.e. table) of policy rules and since the fules are a subset of the policy, 
each rule must correspond to at least one policy, 

B.6. Claim 11 and 22 

The exainer contends that although Moricini does not specifically disclose generating an 
error statement describing the error he does disclose generating a log file, it is well known within 
modern computing systems to automate the generation of error reports from log files. 

B.7. Claim 23 



The examiner contends the Moriconi reference shows predefined data elements as per 
figure 9, i.e. users applications and roles, additionally Moriconi discloses different policies 



Application/Control Number: 09/877,157 
Art Unit: 3621 

grouped within the database management system (element 218 of figure 4). Abraham 
discloses a graphical interface which communicates policies (Abstract) 



For the above reasons, it is believed that the rejections should be sustained, 



Respectfully submitted 
John_M Winter 
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JMW 

April 18, 2005 
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